feat(incidents): CEL query search in incidents

[vinayaknolastname]

Closes #4980

📑 Description

Adds CEL search to the incidents list (same UX as alerts: type a query, press Enter to apply).

Frontend: CEL search bar on incidents page; searchCel combined with facet filters and date range in useIncidentsTableData. Reuses AlertsRulesBuilder with entityName="incidents" (TODO added to split/rename later).

Backend: Preprocess incident CEL so severity strings like "critical" map to DB integers (5). Invalid severities become false instead of SQL 500. Facet option queries get the same preprocessing.

✅ Checks

• My pull request adheres to the code style of this project
• My code requires changes to the documentation
• I have updated the documentation as required
• All the tests have passed

Screen.Recording.2026-07-06.at.7.13.11.PM.mov

ℹ Additional Information

• Restart keep api after pulling backend changes.
• Facet filters use numeric severity (severity in [2]); CEL search uses quoted names (severity == "info").

---

What I learned

• CEL flow: UI → GET /incidents?cel=... → preprocess_cel_expression → CEL→SQL → Postgres.
• Alerts store severity as strings in JSON; incidents store it as integers in Postgres — preprocessing is required for incidents.
• Search CEL and facet CEL are separate in the UI, then combined before the API call.
• CEL empty state should show before facet-filter empty state when search is active.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}